Synthetic teaching example for a website delivery brief. Not a client result, live account test or certification.
One export may have two incompatible destinations
A CRM export opened by a person in a spreadsheet and a file imported into another application need different contracts. A value beginning with a formula-like character can be risky in one context and legitimate data in another. Ordinary CSV escaping handles delimiters and quotes; it is not a universal formula-safety guarantee.
| Field | Synthetic cell | Review decision |
|---|---|---|
| name | =1+1 | REVIEW_BY_FIELD_AND_DESTINATION |
| phone | +61 406 000 000 | Review; do not strip the country prefix blindly |
| amount | -15.00 | Review; may be an intended negative amount |
| note | Meeting, room A | No listed leading prefix; CSV delimiter handling still needed |
Use the filled example
Download the finite Node checker and filled input. Run with Node 24 or newer; no account, API or network is used.
node checks.mjs csv-formula-review csv-formula-review.jsonThe checker flags a small listed set of leading characters, leaves every value unchanged and reports cellsChanged false. NO_LISTED_PREFIX is not SAFE. Whitespace, encoding, separators, application versions and imported cell interpretation can create cases outside this finite demonstration. The arithmetic example is harmless; there is no external-command payload.
Write separate delivery requirements
For a human-view export, agree the destination spreadsheet and a tested text-cell representation. For a machine import, preserve identifiers, numeric meaning and a documented data schema. Test the actual round trip: export, open or import, save, reopen and compare the values. Keep a failing sample rather than overwriting the evidence until a scanner is quiet.
A supplier should explain which transformations occur, how a telephone stays a telephone, and how intended negative amounts survive. Avoid one blanket prefix rule applied to all fields. A separate spreadsheet format with typed cells may be an option, but its behaviour still requires testing in the agreed application.
This file is a review aid, not a sanitizer or proof against every spreadsheet attack. It neither opens Excel nor exports real customers. No existing CSV endpoint or downloaded business dataset is changed.
Primary facts and limits
OWASP: CSV injection: Explains formula interpretation risks and why no single escaping strategy is universal across spreadsheet and downstream-import uses.
Sources reviewed 15 October 2026. The supplied input and acceptance rules are original teaching design; check current platform versions and your actual delivery contract before implementation.
File imports and uploads also need a destination-specific contract